Privacy policy for Carryroo

1. Controller

The controller responsible for processing personal data in connection with the Carryroo platform is:

2. General information

Carryroo is a digital matching platform. Registered users can create handoff requests as Senders or publish real trips and accept requests as Couriers.

Carryroo currently provides registration, login, user profiles, trip publishing and search, internal communication, request and order management, status tracking, notifications, support and feedback handling.

Carryroo does not receive, store, transport or deliver documents or items itself.

This privacy policy explains which personal data we process, for which purposes, on which legal basis and which rights data subjects have.

3. Categories of personal data

Depending on how the platform is used, we may process the following categories of data:

• registration and account data, including email address, display name, password hash, avatar, language, role, account status, registration time, last login and last platform activity
• email verification, code-login and password-reset data, including hashed codes or tokens, expiry, usage and attempt information
• trip data from Couriers, including departure and destination countries or cities, handoff windows, notes, handoff options and trip status
• route-reminder data, including route, expiry, active status and notification deliveries
• request and order data, including participants, document description, weight, dimensions, prices, counter offers, fees, internal payment status, order status and timestamps
• communication data, including messages, participants, timestamps, image or location attachments, system messages and read or delivery status
• notification data, including type, content, linked object, creation time and read time
• feedback and support data, including optional contact, message, category, page or order reference, replies, attachments, processing status and secure access token
• technical data such as IP address, access time, device, browser, operating system, language settings, referrer URL, accessed pages, log files, session IDs, security events and error logs

4. Purposes of processing

We process personal data in particular for the following purposes:

• providing the Carryroo platform
• registration, login and account management
• email verification and password reset
• role management for Sender and Courier workspaces
• publishing, searching and managing trips
• creating, accepting, rejecting, changing and canceling requests
• order management and internal user communication
• notifications, support and feedback handling
• email verification, code login, fraud prevention, abuse prevention and platform security
• enforcing the Terms and published platform rules
• quality assurance and product improvement
• technical security, system stability, legal compliance and legal claims

5. Legal bases for processing

Personal data is processed on the basis of the General Data Protection Regulation (GDPR).

6. Disclosure of data to other users

For requests and orders, the other party may see the display name and avatar, trip, request and order data, rough document description, handoff windows, platform messages and status information.

Users may use other users' data only for the relevant order. Other use, disclosure to third parties, publication or misuse is prohibited.

7. Payment providers

No external payment provider is connected in the current product phase. Displayed payment statuses are currently used only for internal order workflow; Carryroo does not currently collect card or bank-account details for payment processing.

Before external payments are activated, this policy and the user information will be updated with the provider, processed data, purposes, legal bases and recipients.

8. Hosting, technical providers and processors

For the platform's current operation, technical providers may be used in particular for hosting, databases and email delivery.

Where providers process personal data on our behalf, we conclude data processing agreements under Art. 28 GDPR. Information about current processors can be requested at info@enmindustry.com; this policy is updated when material changes occur.

9. Transfers to third countries

Personal data may be transferred outside the EU or EEA if providers are located there, use servers there or enable access from there.

In such cases, we ensure appropriate safeguards under the GDPR, such as adequacy decisions, EU standard contractual clauses, additional safeguards and contractual or technical security measures.

10. Cookies and similar technologies

Carryroo may use cookies and similar technologies. Necessary cookies are required for the technical operation of the platform, such as login sessions, language settings, security functions and order processes.

Non-essential cookies, analytics tools, marketing tools or tracking technologies are used only where valid consent exists, if legally required. Details are shown in the cookie banner or cookie settings.

11. Email, SMS and notifications

We may contact users by email, SMS, in-app message or comparable channels where this is necessary for platform use.

• email verification
• login and security messages
• password reset
• order notifications
• message notifications
• payment and status information
• support and dispute messages
• important changes to platform rules

Marketing messages are sent only if there is a legal basis or consent.

12. Storage and deletion

We store personal data only for as long as necessary for the relevant purposes. The storage period depends in particular on the duration of the user account, open requests or orders, payment or dispute cases, legal retention duties, evidence interests, security and abuse prevention and limitation periods.

After the relevant periods expire, data is deleted or anonymized unless legal obligations or legitimate interests prevent this.

13. Security

We take appropriate technical and organizational measures to protect personal data against loss, misuse, unauthorized access, alteration or disclosure.

• encrypted transmission
• password hashing
• role-based access control
• access restrictions for admin and support areas
• logging of security-relevant events
• time-limited verification and reset tokens
• technical safeguards against unauthorized access
• regular review and improvement of security measures

14. Minors

The platform is not directed at children and may only be used by people who are at least 18 years old.

Carryroo may require age proof or additional confirmations and may restrict or delete accounts if there are doubts about lawful use.

15. Automated decisions and profiling

Carryroo does not currently use profiling or solely automated decisions that produce legal or similarly significant effects.

No solely automated decision with legal effect or similarly significant impact takes place unless we separately inform users and meet the legal requirements.

16. Data subject rights

Data subjects have rights under the GDPR, including access, rectification, deletion, restriction of processing, data portability, objection to certain processing, withdrawal of consent and complaint to a data protection supervisory authority.

To exercise these rights, users can contact us at:

• info@enmindustry.com

17. Right to object

Where we process personal data based on legitimate interests, data subjects may object to processing for reasons relating to their particular situation.

We will then no longer process the personal data unless we can demonstrate compelling legitimate grounds or the processing serves legal claims.

18. Withdrawal of consent

Consent can be withdrawn at any time with effect for the future. Withdrawal does not affect the lawfulness of processing based on consent before withdrawal.

19. Right to complain to a supervisory authority

Data subjects have the right to lodge a complaint with a data protection supervisory authority. The competent authority may be the authority at the data subject's place of residence or at the controller's registered office.

20. Changes to this privacy policy

We may amend this privacy policy if our platform, data processing, providers or legal requirements change. The current version is available on the platform.